Sullivan & Worcester Proactively Addresses Data Privacy and Breach Challenges with Traveling Coaches’ OnGuard Security Awareness
The best solution for a potential challenge is simply to be prepared for it.
With data breaches, hacking threats and security concerns on the rise for organizations worldwide, proactive law firms are exploring ways to implement security awareness to circumvent problems before they occur. Sullivan & Worcester, an AmLaw 200 law firm with 185 attorneys, realized that a proactive stance would enable the highest level of protection for its clients and its overall business. The firm is based in Boston, Massachusetts – a state with some of the most stringent data privacy laws in the United States.
According to Nancy Wahl, IT director for Sullivan & Worcester, “It’s obvious that in this environment the threat of data security issues is topping everyone’s priority list. Lawyers have extra commitments in this respect because we have an ethical obligation to keep clients’ information secure. We have to implement and maintain aggressive security practices so that we can protect our clients.”
But planning comes with challenges for a law firm.
“Our biggest challenge was probably getting lawyers in the office to change their behavior in necessary ways,” explains Ilene Robinson Sunshine, partner and chief privacy officer for Sullivan & Worcester. “Everyone is very concerned about efficiency and speed considering that our business moves at a very quick pace. There is a spectrum with efficiency on one end and security on the other. You have to push people towards the security end of the spectrum, which means they have to spend more time completing their work because employing secure practices typically takes longer than working with insecure ones.”
“Our goal was to implement a coherent and pragmatic security awareness program that would educate the firm’s attorneys and staff about our legal and ethical obligations in the area of security and offer them practical tools for working safely,” says Sunshine. “We aren’t asking everyone to become a security expert, but we are asking them to develop and maintain a heightened awareness of security in their daily work,” comments Sunshine.
Sullivan & Worcester turned to a partner that was well acquainted with law firms and could help guide an effective security awareness program – Traveling Coaches and its OnGuard Security Awareness Program.
“Traveling Coaches has a strong foothold in the legal marketplace,” says Wahl. “When it comes to security awareness, they understand the market, goals and challenges of law firms and had a program ready to go. Other security services and companies approached us regarding this initiative, but compared to Traveling Coaches it was evident that they had just started to understand what would be needed in a general security program - let alone a legal one. Traveling Coaches had the security program, awareness and knowledge of business.”
Top-Down Support for Security Awareness
Sullivan & Worcester understood that cultivating a comprehensive security awareness program – and maintaining its results – would need support from all levels within the law firm from managing partner to IT specialist. When kicking off the strategic planning session for OnGuard with Traveling Coaches, the firm ensured attendance across all groups to capture a “big picture perspective.”
“We saw this as an opportunity to bring together stakeholders from every area of the firm to participate – all administrative heads, all legal practice groups, the managing partner of the firm and the executive director,” explains Sunshine. “People were deeply interested in learning about security issues, thinking -- many for the first time -- about how those issues affect their daily work and offering contributions from their unique perspectives. The process was very collaborative and non-hierarchal.”
Traveling Coaches representatives spent a day on-site with the firm for the strategic planning session, which had 30 people from the firm in attendance. Seating was assigned so that attorneys and staff who typically do not interact in the course of their work had the opportunity to mingle and develop an appreciation for the needs and concerns of the others. This also highlighted the point that security is important in all aspects of the firm’s business.
The conversation and results were eye-opening.
“There were two takeaways that surprised me,” shares Wahl. “First, the overwhelmingly positive response across the board from participants. Second, people listened and were happy to participate. They felt better as a result of the participation, and it gave them ideas of what they needed to do in the course of work but also gave them tools to use for their own personal circumstances.”
Rolling Out the Plan
As a result of the strategic planning session and support from all groups within the law firm, Traveling Coaches and Sullivan & Worcester crafted a comprehensive security awareness program that included town hall meetings, an IT-specific training session and messaging and materials.
After the planning session, Traveling Coaches created a change management plan that summarized the decisions made and outstanding questions. This “blueprint” guided the next steps for the program. The company also worked hand in hand with Sullivan & Worcester to determine where the firm would need support from the Traveling Coach experts.
Part of the program included building an intranet portal that would contain FAQs, IT bulletins, links to learning content, contact information and what to do in case of a breach. The firm partnered with a technology company to create the portal, which was populated with OnGuard Security Awareness videos and documents provided by Traveling Coaches.
The town hall sessions were a critical factor in rolling out OnGuard and gaining awareness.
“The town hall sessions facilitated by Traveling Coaches introduced the major issues and concerns facing law firms today, provided attendees with best practices for addressing different problems, and formally launched the security portal and the new protocol for getting tech support from IT. It demonstrated to everyone that the firm took the matter seriously and gave people a forum to raise issues and ask questions,” describes Sunshine.
Wahl continues, “This is an ongoing program with no beginning, middle and end. You have one chance to make a first impression, and the first impression made in this process during the town hall meetings was highly positive. In fact, we had high engagement from the managing partner who stayed 20 minutes after one of the town hall session for discussion.”
A Heightened Level of Security Awareness
The security awareness program met with extremely positive results. The firm is in the process of an official assessment, but has seen an increase in people sending around articles, asking questions and following up on items they see on the eLearning program.
“Given how difficult it is to implement change within a law firm, we were surprised and pleased that everybody seems to have embraced the security awareness program,” says Sunshine. “The implementation and launch of our security awareness program were a huge success. We had a focused discussion about major security issues and offered practical, reasonable steps that attorneys and staff can take immediately to begin mitigating security risks at work and at home. People paid attention and opted to change their behavior.”
As Wahl explains, “In terms of the rollout, we’re still early in the process. However, I’m personally noticing an added level of awareness. There are conversations in the elevator with attorneys, email requests asking how to handle specific potential issues, and people are logging off of their computers at the end of the day.”
“I noticed that a number of attorneys were proactively reaching out to clients to talk about issues they saw or changes in clients’ practices or technology,” continues Wahl. “That was a tremendous result. It reflects the success of the program and the success of affecting change. Attorneys often say that their clients won’t change, but they talked to them to create a more secure way to conduct business.”
“We got great feedback from the lawyers and staff, who emphasized the value of the town hall sessions as a way to disseminate a great deal of important information in an efficient and effective manner. Traveling Coaches really put a lot into this. They were very responsive and knowledgeable,” states Sunshine.